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Foreword 


This  Recommended  Standard  by  The  Aerospace  Corporation  is  an  update  to  “Space  Systems  -  Flight 
Pressurized  Systems,”  TR-RS-2007-00005  originally  released  as  TOR-2003(8583)-2896  Revision  A. 
The  Recommended  Standard  has  as  its  origin  all  the  requirements  set  forth  for  the  flight  pressurized 
systems  in  Section  4,  General  Design  Requirements,  and  Section  6,  Pressurized  Systems 
Requirements,  of  M1L-STD-1522A,  Standard  General  Requirements  of  Safe  Design  and  Operation  of 
Pressurized  Missile  and  Space  Systems.  This  latest  revision  clarifies  requirements  and  purposely 
separates  mission  assurance  requirements  and  system  safety  requirements. 

It  is  the  intent  that  this  Recommended  Standard  be  used  together  with  the  latest  revisions  of 
ANSI/AIAA  S-080,  Space  Systems  -  Metallic  Pressure  Vessels,  Pressurized  Structures,  and  Pressure 
Components  and  S-081,  Space  Systems  -  Composite  Overwrapped  Pressure  Vessels  (COPVs)  as 
compliance  documents  for  the  space  flight  pressure  hardware  in  space  system  acquisitions. 
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1.  Introduction 


1.1  Scope 

This  Recommended  Standard  establishes  the  baseline  requirements  for  the  design,  fabrication, 
assembly,  installation,  test,  inspection,  operation,  and  maintenance  of  pressure  systems  used  in 
spacecraft  and  launch  vehicles.  It  deals  primarily  with  the  interfaces  between  the  pressure  vessel(s), 
or  pressurized  structures,  and  the  corresponding  pressure  components  within  a  specific  pressure 
system;  and  interfaces  between  a  pressure  system  and  other  spacecraft  or  launch  vehicle  systems. 
These  requirements,  when  implemented  on  a  specific  pressure  system,  will  assure  a  high  level  of 
confidence  in  achieving  safe  and  reliable  operation. 

1.2  Application 

This  Recommended  Standard  is  applicable  to  all  pressure  systems  installed  and  operated  in 
spacecraft,  launch  vehicles,  and  other  space  systems.  Whereas  this  Recommended  Standard  pertains 
to  the  pressure  system,  the  pressure  vessels  and/or  pressurized  structures  and  all  associated  pressure 
components  that  comprise  the  system  are  governed  by  the  design  and  test  requirements  specified  in 
References  7  and/or  8,  as  appropriate. 

Note  that  pressure  systems  specifically  excludes  special  pressurized  equipment  as  defined  in 
Reference  7  (e.g.,  heat  pipes  and  batteries)  and  solid  rocket  motors  cases  which  are  controlled  by 
Reference  9. 

The  requirements  specified  in  this  Recommended  Standard  may  be  tailored  for  specific  programs 
with  the  approval  of  the  appropriate  approval  authority.  Tailoring  of  the  requirements  should  be 
accompanied  by  a  risk  assessment  per  the  process  detailed  in  Reference  2  in  order  to  remain 
compliant  with  Reference  2. 
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2.  Referenced  Documents 


The  following  documents  of  the  issue  in  effect  on  the  date  of  invitation  for  bids  or  request  for 
proposal  form  a  part  of  this  standard  to  the  extent  referenced  herein. 


1. 

MIL-STD-202G 

Test  Method  Standard  Electronic  and  Electrical 
Component  Parts 

2. 

M1L-STD-882E 

Department  of  Defense  Standard  Practice,  System 
Safety 

3. 

M1L-STD-1472 

Military  Standard,  Fluman  Engineering  Design  Criteria 
for  Military  Systems,  Equipment,  and  Facilities 

4. 

MIL-E-6051 

Electromagnetic  Compatibility  Requirements  Systems 

5. 

M1L-S-8512 

Support  Equipment,  Aeronautical,  Special,  General 
Specification  for  the  Design  of 

6. 

AFSPCMAN  91-710 

Range  Safety  User  Requirements  Manual 

7. 

ANSI/AIAA  S-080-1998 

Space  Systems  -  Metallic  Pressure  Vessels,  Pressurized 
Structures,  and  Pressure  Components 

8. 

ANSI/A1AA  S-081A-2006 

Space  Systems  -  Composite  Overwrapped  Pressure 
Vessels  (COP Vs) 

9. 

TOR-2003(8583)-2895,  Rev  1. 

Solid  Rocket  Motor  Case  Design  and  Test  (SMC-S- 
006) 

10. 

TR-RS-20 14-000 16 

Test  Requirements  for  Launch,  Upper-Stage,  and  Space 
Vehicles  (SMC-S-016-2014) 

11. 

DOT/FAA/AR-MMPDS-0 1 

Metallic  Materials  Properties  Development 
Standardization  (MMPDS) 

12. 

CINDAS/USAF 

Aerospace  Structural  Metals  Flandbook 

13. 

MIL-HDBK-17 

Composite  Materials  Flandbook 

14. 

TOR-2006(8583)-1 

Configuration  Management  (SMC-S-002) 

15. 

SAE  AS9100 

Quality  Systems  -  Aerospace  -  Model  for  Quality 
Assurance  in  Design,  Development  Production, 
Installation  and  Servicing 

Unless  otherwise  indicated,  copies  of  federal  and  military  specifications,  standards,  and  handbooks 
are  available  from  Department  of  Defense  Single  Supplv  Point  at  http://quicksearch.dla.mil. 

AIAA  standards  must  be  procured  directly  from  the  owner. 
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Aerospace  TORs  are  available  from  the  Aerospace  Corporate  Library.  Requests,  on  official  letter¬ 
head,  should  be  addressed  to: 

The  Aerospace  Corporate  Library 
Mail  Stop  Ml -199 
P.O.  Box  92957 
Los  Angeles,  CA  90009-2957 
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3.  Vocabulary 


3.1  Abbreviations  and  Acronyms 

COPV  Composite  Overwrapped  Pressure  Vessel 

DSF  Design  Safety  Factor 

MEOP  Maximum  Expected  Operating  Pressure 

MS  Margin  of  Safety 

NDI  Nondestructive  Inspection 

NVR  Non-volatile  Residue 

3.2  Definitions 

The  following  definitions  of  significant  terms  are  provided  to  ensure  precision  of  meaning  and 
consistency  of  usage.  In  the  event  of  a  conflict,  the  definitions  listed  here  apply. 

A-Basis  Allowable:  The  mechanical  strength  or  strain  values  such  that  99%  of  the  population  will 
meet  or  exceed  the  specified  values  with  a  confidence  level  of  95%. 

Acceptable  Risk:  The  risk  is  a  combination  of  the  severity  of  the  mishap  and  the  probability  that  the 
mishap  will  occur.  Acceptable  risk  refers  to  risk  that  the  appropriate  acceptance  authority  is  willing  to 
accept  without  additional  mitigation. 

Acceptance  Tests:  The  required  formal  tests  conducted  on  the  flight  hardware  to  ascertain  that  the 
materials,  manufacturing  processes,  and  workmanship  meet  specifications  and  that  the  hardware  is 
acceptable  for  intended  usage. 

Applied  Load  (Stress):  The  actual  load  (stress)  imposed  on  the  pressurized  hardware  item  in  the 
service  environment. 

B-Basis  Allowable:  The  mechanical  strength  values  such  that  90%  of  the  population  will  meet  or 
exceed  the  specified  values  with  a  95%  confidence  level. 

Burst  Factor:  The  burst  factor  is  a  multiplying  factor  applied  to  the  maximum  expected  operating 
pressure  (MEOP)  to  obtain  the  design  burst  pressure. 

Burst  Pressure:  The  real  pressure  level  at  which  rupture  or  unstable  fracture  of  the  pressurized 
hardware  item  occurs. 

Component:  A  functional  unit  that  is  viewed  as  an  entity  for  the  purpose  of  analysis,  manufacturing, 
maintenance,  or  recordkeeping. 

Critical  Condition:  The  most  severe  environmental  condition  for  a  particular  failure  mode  in  terms 
of  loads,  pressures  and  temperatures,  or  combination  thereof  imposed  on  systems,  subsystems,  and 
components  during  service  life. 


4 


Damage-Tolerance  Life  (Safe-Life):  The  required  period  of  time  or  number  of  cycles  that  the 
structure,  containing  the  largest  crack  undetectable  by  NDI,  is  shown  by  analysis  or  testing  to  survive 
without  leaking  or  failing  catastrophically  in  the  expected  service  load  and  environment. 

Design  Burst  Pressure:  A  pressure  that  the  pressurized  hardware  must  withstand  without  rupture  in 
the  applicable  operating  environment.  It  is  equal  to  the  product  of  the  maximum  expected  operating 
pressure  (MEOP)  and  a  design  ultimate  (burst)  factor. 

Design  Safety  Factor  (DSF):  A  multiplying  factor  to  be  applied  to  limit  loads  and/or  MEOP  for 
purposes  of  analytical  assessment  and/or  test  verification  of  structural  adequacy. 

Detrimental  Deformation:  The  structural  deformation,  deflection,  or  displacement  that  prevents  any 
portion  of  the  structure  from  performing  its  intended  function,  or  that  reduces  the  probability  of 
successful  completion  of  the  mission. 

Fatigue:  The  process  of  progressive  localized  permanent  structural  change  occurring  in  a  material 
subjected  to  conditions  which  produce  fluctuating  stresses  and  strains  at  some  point  or  points  and 
which  may  culminate  in  cracks  or  complete  fracture  after  a  sufficient  number  of  fluctuations. 

Fittings:  Components  of  a  pressurized  system  utilized  to  connect  lines,  other  pressure  components 
and/or  pressure  vessels  within  the  system. 

Flaw:  A  local  discontinuity  in  a  structural  material,  such  as  a  scratch,  notch,  crack  or  void. 

Hazard:  A  real  or  potential  condition  that  could  lead  to  an  unplanned  event  or  series  of  events  (i.e. 
mishap)  resulting  in  death,  injury,  occupational  illness,  damage  to  or  loss  of  equipment  or  property,  or 
damage  to  the  environment. 

Hazard  Analysis:  The  analysis  of  systems  to  determine  potential  hazards  and  recommended  actions 
to  eliminate  or  control  the  hazards. 

Hydrogen  Embrittlement:  A  mechanical-environmental  failure  process  that  results  from  the  initial 
presence  or  absorption  of  excessive  amounts  of  hydrogen  in  metals,  usually  in  combination  with 
residual  or  applied  tensile  stresses. 

Initial  Flaw:  A  flaw  or  a  crack-like  defect  in  a  structural  material  before  the  application  of  load 
and/or  deleterious  environment. 

Limit  Load:  The  maximum  expected  external  load  or  combination  of  loads,  that  a  structure  may 
experience  during  the  performance  of  specified  missions  in  specified  environments.  When  a  statistical 
estimate  is  applicable,  the  limit  load  is  that  load  not  expected  to  be  exceeded  at  99%  probability  with 
90%  confidence. 

Lines:  Tubular  pressure  components  of  a  pressurized  system  provided  as  a  means  for  transferring 
fluids  between  components  of  the  system. 

Margin  of  Safety  (MS):  MS  =  Allowable  Load/(Limit  Load  x  DSF)  -  1.  Note  that  load  may  mean 
stress  or  strain. 
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Maximum  Expected  Operating  Pressure  (MEOP):  The  maximum  pressure  which  the  pressurized 
hardware  is  expected  to  experience  during  its  service  life  in  association  with  its  applicable  operating 
environments. 

Mishap:  An  event  or  series  of  events  resulting  in  unintentional  death,  injury,  occupational  illness, 
damage  to  or  loss  of  equipment  or  property,  or  damage  to  the  environment.  For  the  purposes  of  this 
Standard,  the  term  “mishap”  includes  negative  environmental  impacts  from  planned  events. 

Peak  Transient  Pressure:  The  maximum  value  of  a  pressure  wave  associated  with  the  sudden 
opening  or  closing  of  a  valve  or  with  ignition,  and  that  persists  for  only  a  fraction  of  a  second. 

Pressure  Component:  A  component  in  a  pressurized  system,  other  than  a  pressure  vessel, 
pressurized  structure,  or  special  pressurized  equipment  that  is  designed  largely  by  the  internal 
pressure.  Examples  are  lines,  fittings,  gauges,  valves,  filters,  bellows,  and  hoses. 

Pressure  Vessel:  A  container  designed  primarily  for  the  storage  of  pressurized  fluids  and  which 

1)  Contains  stored  energy  of  14,240  ft-lb  (19,310  joules)  or  greater,  based  on  adiabatic 
expansion  of  a  perfect  gas;  or 

2)  Contains  gas  or  liquid  which  will  create  a  mishap  (  accident)  if  released;  or 

3)  Will  experience  a  MEOP  greater  than  100  psi  (700  kPa). 

Special  pressurized  equipment  such  as  batteries,  sealed  containers,  heat  pipes,  and  cryostats  are  not 
included. 

Pressurized  Structures:  Structures  designed  to  carry  both  internal  pressure  and  vehicle  structural 
loads.  The  main  propellant  tank  of  a  launch  vehicle  is  a  typical  example. 

Pressurized  System:  A  system  that  consists  of  pressure  vessels,  or  pressurized  structures,  or  both, 
and  other  pressure  components  such  as  lines,  fittings,  valves,  and  bellows  that  are  exposed  to  and 
structurally  designed  largely  by  the  acting  pressure.  Not  included  are  electrical  or  other  control 
devices  required  for  system  operation.  Pressurized  system  is  synonymous  with  pressure  system.  Note 
that  in  other  documents  such  as  Reference  10,  the  term  “system”  refers  to  the  entire  vehicle  and 
“subsystem”  refers  to  completed  assemblies  like  propulsion.  A  propulsion  subsystem  per  Reference 
1 0  is  termed  a  pressurized  system  within  this  document. 

Proof  Factor:  A  multiplying  factor  applied  to  the  limit  load  or  MEOP  to  obtain  proof  load  or  proof 
pressure  for  use  in  the  acceptance  testing. 

Proof  Pressure:  The  proof  pressure  is  used  to  give  evidence  of  satisfactory  workmanship  and 
material  quality  and/or  establish  maximum  initial  flaw  sizes  for  damage-tolerance  life  (safe-life) 
demonstration.  It  is  equal  to  the  product  of  MEOP  and  a  proof  factor. 

Qualification  Tests:  The  required  formal  contractual  tests  used  to  demonstrate  that  the  design, 
manufacturing,  and  assembly  have  resulted  in  hardware  designs  conforming  to  specification 
requirements. 
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Safety-critical:  A  term  applied  to  a  condition,  event,  operation,  process,  or  item  whose  mishap 
severity  consequence  is  either  Catastrophic  or  Critical  (e.g.,  safety-critical  function,  safety-critical 
path,  and  safety-critical  component). 

Safety-critical  item:  A  hardware  or  software  item  that  has  been  determined  through  analysis  to 
potentially  contribute  to  a  hazard  with  Catastrophic  or  Critical  mishap  potential,  or  that  may  be 
implemented  to  mitigate  a  hazard  with  Catastrophic  or  Critical  mishap  potential.  See  Reference  2  for 
further  description. 

Scatter  Factor:  A  factor  applied  to  the  estimated  life  of  a  structure  to  provide  the  certifiable  life  in 
fatigue  analyses. 

Service  Life:  The  period  of  time  (or  cycles)  starting  with  the  manufacturing  of  the  pressurized 
hardware  and  continuing  through  all  acceptance  testing,  handling,  storage,  transportation,  launch 
operations,  orbital  operations,  refurbishment,  retesting,  reentry  or  recovery  from  orbit,  and  reuse  that 
may  be  required  or  specified  for  the  flight  pressure  system. 

Special  Pressurized  Equipment:  A  piece  of  equipment  that  meets  the  pressure  vessel  definition,  but 
which  is  not  feasible  or  cost  effective  to  comply  with  the  requirements  applicable  to  pressure  vessels. 
Included  are  batteries,  heat  pipes,  cryostats  and  sealed  containers.  See  Reference  7  for  further 
description  and  requirements. 

Stress-Corrosion  Cracking:  A  mechanical  environmental  induced  failure  process  in  which  sustained 
tensile  stress  and  chemical  attack  combine  to  initiate  and  propagate  a  crack  or  a  crack-like  flaw  in  a 
metal  part. 

System  Safety:  The  application  of  engineering  and  management  principles,  criteria,  and  techniques 
to  achieve  acceptable  risk  within  the  constraints  of  operational  effectiveness  and  suitability,  time,  and 
cost  throughout  all  phases  of  the  system  life-cycle. 

Ultimate  Load:  The  product  of  the  limit  load  and  the  ultimate  design  safety  factor.  It  is  the  load  that 
the  structure  must  withstand  without  rupture  or  collapse  in  the  expected  operating  environments. 
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4.  General  Requirements 


This  section  presents  general  requirements  for  pressurized  systems  in  terms  of:  (a)  design,  analysis, 
material  selection  and  characterization,  fabrication  and  process  control;  (b)  quality  assurance, 
operation  and  maintenance,  including  repair,  and  refurbishment;  and,  (c)  storage.  Additional  detailed 
system  requirements  are  presented  in  Section  5.  Requirements  specific  to  system  safety  are  presented 
in  Section  6. 

4.1  System  Analysis  Requirements 

4.1.1  System  Pressure  Analysis 

MEOP  is  used  as  the  baseline  internal  pressure  necessary  for  test  verification  purposes.  Each 
component  within  the  pressurized  system  will  have  an  MEOP.  If  a  selected  component  is  over- 
designed  in  terms  of  MEOP  for  the  particular  application,  MEOP  should  still  refer  to  the  required 
application  and  a  different  term  or  qualifier  should  be  used  in  referencing  the  over-designed 
capability. 

As  MEOP  is  determined  at  the  system  level,  the  unit  requirements  on  MEOP  in  Reference  7  and  8  are 
superseded  by  the  following  more  specific  set  of  requirements. 

[4. 1.1-1]  A  thorough  analysis  shall  be  performed  to  establish  the  correct  MEOP,  leak  rates,  flow  rates 
and  other  relevant  performance  parameters  for  all  pressurized  hardware  within  the  pressurized 
system. 

[4. 1.1-2]  For  systems  with  zones  operating  at  different  pressures,  the  MEOP  of  pressure  components 
and/or  pressure  vessels  within  each  zone  shall  be  determined.  Examples  of  zones  include  portions  of  a 
system  upstream  and  downstream  of  a  pressure  regulator  and  portions  of  a  system  isolatable  by 
closure  of  a  valve. 

[4. 1.1-3]  MEOP  shall  include  the  variation  of  pressure  with  temperature  during  the  service  life  in 
determining  the  maximum. 

[4. 1.1 -4]  MEOP  shall  include  the  system  pressure  rise  allowed  due  to  valve  back  pressure  relief, 
regulator  lockup  behavior,  and  relief  valve  settings  to  include  the  tolerance  of  each  of  these 
parameters. 

[4. 1.1-5]  MEOP  shall  include  effect  of  vehicle  acceleration. 

[4. 1.1-6]  MEOP  shall  include  the  required  fault  tolerance  aspects  that  affect  maximum  pressure.  For 
example,  single-fault  tolerant  systems  with  a  pressure  regulator  must  include  the  increased  pressure 
provided  by  the  redundant  regulator  stage  lockup  condition  as  the  primary  stage  failure  must  be 
“tolerated”  as  part  of  the  “expected”  condition. 

[4. 1.1-7]  The  MEOP  of  pressure  vessels  and  pressurized  structures  shall  include  the  peak  transient 
pressure  incident  on  these  units  resulting  from  system  operation.  It  should  be  noted  that  hydraulic 
transients  typically  have  little  amplitude  within  a  pressure  vessel. 

[4. 1.1-8]  For  pressure  components,  the  proof  pressure  shall  exceed  the  peak  transient  pressure  arising 
in  the  component  due  to  system  operation  such  as  valve  actuation  and  water  hammer.  To  be  explicit, 
the  pressure  component  MEOP  need  not  include  that  portion  of  the  peak  transient  pressure  that 


persists  for  only  a  fraction  of  a  second.  The  ability  of  the  hardware  to  withstand  the  transient 
condition  without  detrimental  deformation  is  verified  by  the  peak  pressure  being  below  the  proof 
pressure  level.  For  instances  where  the  peak  transient  pressure  falls  below  the  product  of  the  MEOP 
and  the  standard  proof  factor,  this  requirement  is  met  with  no  added  implementation  requirements. 
For  instances  where  the  peak  transient  pressure  would  otherwise  exceed  the  product  of  the  MEOP  and 
the  standard  proof  factor,  this  requirement  can  be  accomplished  by  either  raising  the  MEOP  value  or 
by  increasing  the  proof  factor. 

[4. 1.1-9]  For  pressure  components,  the  ratio  of  the  design  burst  pressure  to  the  proof  pressure  shall  be 
greater  than  or  equal  to  the  ratio  of  the  burst  factor  to  the  proof  factor  as  specified  in  Reference  7’s 
Table  2.  If  the  proof  factor  was  adjusted  to  accommodate  peak  transient  pressures,  this  requirement 
can  be  accomplished  by  either  raising  the  MEOP  value  or  by  increasing  the  burst  factor. 

4.1.2  System  Analysis 

[4. 1.2-1]  A  detailed  system  functional  analysis  of  the  pressurized  system  shall  be  performed  to 
determine  that  the  operation,  interaction,  and  sequencing  of  components  within  the  pressurized 
system  are  capable  of  supporting  all  required  actions. 

Related  system  safety  requirements  are  in  Section  6. 

[4. 1.2-2]  System  analysis  data  shall  show  that: 

a)  The  system  provides  the  capability  of  maintaining  pressure  within  MEOP  in  the  event  of 
interruption  of  any  process  or  control  sequence  at  any  time  during  test  or  flight. 

b)  Redundant  pressure  relief  devices  have  independent  pressure  escape  routes  during  all  stages 
of  operation. 

4.2  Structural  Design  Requirements 

This  section  delineates  the  general  design  requirements  for  a  pressurized  system. 

[4.2-1]  The  components  of  the  pressurized  system,  including  pressure  vessels,  pressurized  structures, 
and  pressure  components,  shall  comply  with  Reference  7  (metallic  hardware)  and  Reference  8 
(composite  hardware). 

4.2.1  Loads,  Pressures,  and  Environments 

[4.2. 1-1]  The  entire  anticipated  load-pressure-temperature  history  and  associated  environments 
throughout  the  service  life  of  the  pressurized  system  shall  be  determined  in  accordance  with  specified 
mission  requirements. 

[4.2. 1-2]  As  a  minimum,  the  following  factors  and  their  statistical  variations  shall  be  considered  as 
appropriate: 

a)  The  environmentally  and  operationally  induced  loads  and  pressures  including  transient 
pressure  oscillations  such  as  from  water  hammer. 

b)  The  environments  acting  simultaneously  with  these  loads  and  pressures  with  their  proper 
relationships.  Environments  include  temperatures  and  thermal  gradients. 
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c)  The  frequency  of  application  of  these  loads,  pressures,  environments,  and  their  levels  and 
duration. 

[4.2. 1-3]  These  data  derived  in  [4.2. 1-1]  and  [4.2. 1-2]  shall  be  used  to  define  the  design  spectra  used  for 
both  design  analysis  and  testing. 

[4.2. 1-6]  The  design  spectra  shall  be  revised  as  the  structural  design  develops  and  the  loads  analysis 
matures. 

4.2.2  Strength 

[4.2.2- 1]  All  pressure  hardware  within  the  pressurized  system  including  component  interfaces, 
attachments,  tie-downs,  and  other  critical  points  shall  possess  sufficient  strength  to  withstand  limit 
loads,  MEOP,  and  transient  pressures  in  the  expected  operating  environments  throughout  the  service 
life  without  experiencing  detrimental  deformation. 

[4.2.2-2]  All  pressurized  hardware  shall  sustain  system-level  proof  pressure  without  incurring  gross 
yielding  or  detrimental  deformation. 

[4.2.2-3]  All  pressurized  hardware  shall  also  withstand  ultimate  loads  (external  loading)  and  design 
burst  pressure  (internal  loading)  in  the  expected  operating  environments  without  experiencing  rupture 
or  collapse. 

Further  strength  requirements  for  pressure  vessels,  pressurized  structures,  and  pressure  components 
are  in  Reference  7  Section  4.2.2  and  Reference  8  Section  5.2.2. 

[4.2.2-4]  The  margin  of  safety  shall  be  positive  and  shall  be  determined  by  analysis  or  test  at  design 
ultimate  and  design  limit  levels,  when  appropriate,  at  the  temperatures  expected  for  all  critical 
conditions. 

4.2.3  Stiffness 

[4.2.3- 1]  The  mounting  and  arranging  of  all  components  in  the  pressurized  system  and  their  stiffness 
effect  on  resonant  response  shall  be  factored  into  the  design  of  the  flight  pressure  system. 

[4.2.3-2]  The  stiffness  properties  of  the  pressure  system  shall  be  such  as  to  prevent  all  detrimental 
instabilities  of  coupled  vibration  modes,  minimize  detrimental  effects  of  the  loads  and  dynamics 
response  that  are  associated  with  structural  flexibility,  and  avoid  detrimental  deformation  due  to 
contact  with  other  vehicle  systems. 

4.2.4  Thermal  Effects 

[4.2.4-1]  Thermal  effects,  including  heating  and  cooling  rates,  temperatures,  thermal  gradients, 
thermal  stresses  and  deformations,  and  changes  with  temperature  of  the  physical  and  mechanical 
properties  of  the  material  of  construction,  shall  be  factored  into  the  design  of  the  flight  pressure 
system. 

[4.2.4-2]  Thermal  effects  shall  be  based  on  temperature  extremes  that  simulate  those  predicted  for  the 
operating  environment  plus  a  design  margin  as  specified  in  Reference  10. 
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4.2.5  Stress  Analysis 


[4.2.5- 1]  A  detailed  and  comprehensive  stress  analysis  of  each  pressurized  system  design  shall  be 
conducted  to  verify  the  hardware  strength  and  stiffness,  with  the  assumption  that  no  crack-like  flaws 
exist  in  the  hardware. 

[4.2. 5-2]  The  mounting  and  arranging  of  all  components  in  the  pressurized  system  and  their  effect  at 
interfaces  between  components  and  at  mounting  brackets  when  subjected  to  the  combined  effects 
from  limit  loads,  MEOP,  and  deflections  of  the  supporting  structures  shall  be  included  in  the  stress 
analysis. 

[4.2. 5-3]  The  analysis  shall  determine  stresses  resulting  from  the  combined  effects  of  internal 
pressure,  ground  or  flight  loads,  temperatures,  and  thermal  gradients. 

[4.2. 5-4]  Both  membrane  stress  and  bending  stress  resulting  from  internal  pressure  and  external  loads 
shall  be  calculated  as  appropriate  to  account  for  the  effects  of  geometrical  discontinuities,  design 
configuration,  and  structural  support  attachments. 

[4.2. 5-5]  The  analysis  shall  include  the  effects  of  adding  stresses  from  restraints,  torque  forces  induced 
in  flexible  connections,  manufacturing  tolerances,  test  conditions,  residual  stresses,  and  assembly 
stresses. 

[4.2. 5-6]  Thermal  effects,  including  heating  rates,  temperatures,  thermal  gradients,  thermal  stresses 
and  deformations,  and  changes  in  the  physical  and  mechanical  properties  of  the  materials  due  to 
environmental  factors,  shall  be  considered  in  the  stress  analysis. 

[4.2. 5-7]  Loads  shall  be  combined  by  using  the  appropriate  design  safety  factors  on  the  individual  load 
and  the  results  shall  be  compared  to  allowable  loads.  The  appropriate  design  safety  factors  are  given 
in  References  7  and  8.  Adjustments  to  the  appropriate  design  safety  factors  for  pressure  components 
under  peak  transient  pressure  conditions  are  given  in  Section  4.1.1  ([4. 1.1-8]  and  [4. 1.1-9]). 

[4.2. 5-8]  Design  safety  factors  on  external  (support)  loads  shall  be  as  assigned  to  the  primary 
structure(s)  supporting  the  pressurized  system. 

[4.2. 5-9]  The  effects  of  flexure  of  lines,  pressure  vessels,  and  supporting  structures  being  acted  on  by 
the  loads,  pressures,  and  environments  shall  be  accounted  for  in  the  analysis. 

[4.2.5-10]  Classical  solutions,  finite  element  methods,  or  other  proven  equivalent  structural  analysis 
techniques  shall  be  used  to  calculate  the  stresses,  strains,  and  displacements. 

[4.2.5-11]  Minimum  material  gauges  as  specified  in  the  design  drawing  shall  be  used  in  the  stress 
analysis. 

[4.2.5-12]  The  allowable  material  strength  shall  reflect  the  effects  of  temperature,  thermal  cycling  and 
gradients,  processing  variables,  and  time  associated  with  the  design  environments. 

[4.2.5-13]  The  effect  of  thickness  gradients  and  variations  in  material  thickness  and  manufacturing- 
process  parameters,  as  specified  in  the  design  documentation,  shall  be  used  in  the  stress  analysis. 

[4.2.5-14]  Variations  in  manufacturing  and  other  design  tolerances  shall  be  accounted  for. 
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[4.2.5-15]  Evaluation  of  buckling  strength  shall  consider  the  combined  action  of  primary  and 
secondary  stresses  and  their  effects  on  general  instability,  local  or  panel  instability,  and  crippling. 


[4.2.5-16]  Minimum  margin  of  safety  associated  with  the  parent  materials,  weldments  and  heat- 
affected  zones  shall  be  calculated  and  tabulated  for  all  critical  locations  of  the  pressurized  system 
along  with  their  stress  levels. 

[4.2.5-17]  The  margin  of  safety  shall  be  positive  against  the  strength  and  stiffness  requirements  of 
Section  4.2.2  and  4.2.3,  respectively. 

[4.2.5-18]  Records  of  the  stress  analysis  shall  be  maintained. 

[4.2.5-19]  The  records  shall  include  the  input  parameters,  data,  assumptions,  rationales,  methods, 
references,  and  summary  of  significant  analysis  results. 

[4.2.5-20]  The  analysis  shall  be  revised  and  updated  to  maintain  currency  for  the  life  of  the  program. 

4.2.6  Fatigue  Analysis 

[4.2.6- 1]  In  addition  to  the  stress  analysis,  conventional  fatigue-life  analysis  shall  be  performed,  as 
appropriate,  on  the  unflawed  pressurized  system. 

[4.2. 6-2]  Nominal  values  of  fatigue-life  (S-N)  data  shall  be  taken  from  reliable  sources  such  as 
Reference  1 1  and  12,  or  other  sources  approved  by  the  procuring  agency. 

[4.2.6-3]  A  scatter  factor  of  four  (4)  shall  be  applied  to  the  service  life. 

[4.2. 6-4]  The  limit  for  accumulated  fatigue  damage  using  Miner’s  Rule  shall  be  80%  of  the  normal 
limit,  i.e.,  En/N  <  0.8. 

4.3  Material  Requirements 

4.3.1  Metallic  Materials 

[4.3. 1-1]  Metallic  materials  used  in  the  assembly  and  installation  of  a  specific  pressurized  system  shall 
be  selected,  evaluated,  and  characterized  to  ensure  all  system  requirements  are  met. 

4. 3. 1.1  Metallic  Material  Selection 

[4. 3. 1.1-1]  Metallic  materials  shall  be  selected  on  the  basis  of  proven  environmental  compatibility, 
material  strength,  and  fatigue  characteristics. 

[4. 3. 1.1-2]  Unless  otherwise  specified,  the  material’s  A-basis  allowable  shall  be  used  in  any 
application  where  failure  of  a  single  load  path  would  result  in  loss  of  structural  integrity  to  any  part  of 
the  pressurized  system. 

[4. 3. 1.1-3]  For  applications  where  failure  of  a  redundant  load  path  would  result  in  a  safe  redistribution 
of  applied  loads  to  other  load  carrying  members,  the  material’s  B-basis  allowable  may  be  used. 
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4.3. 1.2 


Metallic  Material  Evaluation 


[4. 3. 1.2-1]  The  selected  metallic  materials  shall  be  evaluated  with  respect  to  material  processing, 
fabrication  methods,  manufacturing  operations,  refurbishment  procedures  and  processes,  and  other 
factors  that  affect  the  resulting  strength  and  fracture  properties  of  the  material  in  the  fabricated  as  well 
as  the  refurbished  configurations. 

[4. 3. 1.2-2]  The  evaluation  shall  ascertain  that  the  mechanical  properties,  strengths,  fatigue,  and 
fracture  properties  used  in  design  and  analyses  will  be  realized  in  the  actual  hardware  and  that  these 
properties  are  compatible  with  the  fluid  contents  and  the  expected  operating  environments. 

[4. 3. 1.2-3]  Materials  which  are  susceptible  to  stress-corrosion  cracking  or  hydrogen  embrittlement 
shall  be  evaluated  by  performing  sustained-load  fracture  tests  when  applicable  data  are  not  available. 

4. 3. 1.3  Metallic  Material  Characterization 

[4. 3. 1.3-1]  The  allowable  mechanical,  fatigue,  and  fracture  properties  of  all  selected  metallic  materials 
shall  be  obtained  from  reliable  sources  such  as  Reference  1 1 ,  and  other  sources  approved  by  the 
procuring  agency. 

[4. 3. 1.3-2]  Where  material  properties  are  not  available,  they  shall  be  determined  by  test  methods 
approved  by  the  procuring  agency. 

4.3.2  Composite  Materials 

4.3.2. 1  Composite  Material  Selection 

[4. 3.2. 1-1]  Composite  materials  used  for  a  part  in  a  specific  pressurized  system  shall  be  selected  on  the 
basis  of  environmental  compatibility,  material  strength/modulus,  and  stress-rupture  properties. 

[4. 3.2. 1-2]  The  effects  of  fabrication  process,  temperature/humidity,  load  spectra,  and  other 
conditions,  that  may  affect  the  strength  and  stiffness  of  the  material  in  the  fabricated  configuration, 
shall  also  be  included  in  the  rationale  for  selecting  the  composite  materials. 

4. 3. 2. 2  Composite  Material  Evaluation 

[4. 3. 2.2-1]  The  materials  selected  for  a  composite  part  shall  be  evaluated  with  respect  to  the  material 
processing,  fabrication  methods,  manufacturing  operations  and  processes,  operating  environments, 
service  life  and  other  pertinent  factors  that  affect  the  resulting  strength  and  stiffness  properties  of  the 
material  in  the  fabricated  configurations. 

4. 3. 2. 3  Composite  Material  Characterization 

[4. 3. 2.3-1]  The  properties  of  the  composite  materials  selected  shall  be  characterized  in  their  expected 
operating  environments. 

[4. 3. 2.3-2]  The  properties  of  all  selected  composite  materials  shall  be  obtained  from  reliable  sources 
such  as  Reference  13. 

[4.3.2.3-3]  Where  material  properties  are  not  available,  they  shall  be  determined  by  test  methods 
approved  by  the  procuring  agency. 
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4.3.3  Polymeric  Materials 

4.3.3. 1  Polymer  Material  Selection 

[4.3.3. 1-1]  Polymeric  materials  used  for  a  part  or  for  joining  parts  in  the  pressurized  system  shall  be 
selected  on  the  basis  of  environmental  compatibility,  material  strength/modulus,  fatigue,  creep 
deformation/relaxation,  stress-rupture  properties,  and  suitability  as  an  adhesive,  as  dictated  by  the 
application. 

[4. 3. 3. 1-2]  The  effects  of  fabrication  process,  temperature/humidity,  load  spectra,  and  other  conditions 
that  may  affect  the  strength,  stiffness,  and  dimensional  tolerance  of  the  material  in  the  fabricated 
configuration  shall  also  be  included  in  the  rationale  for  selecting  the  polymeric  materials. 

4. 3. 3. 2  Polymer  Material  Evaluation 

[4. 3. 3. 2-1]  The  materials  selected  for  a  polymeric  part  in  the  pressurized  system  shall  be  evaluated 
with  respect  to  the  material  processing,  manufacturing  operations  and  processes,  operating 
environments,  service  life,  and  other  pertinent  factors  that  affect  the  resulting  strength,  stiffness,  and 
dimensional  tolerance  properties  of  the  material  in  the  fabricated  configurations. 

4. 3. 3. 3  Polymer  Material  Characterization 

[4. 3. 3. 3-1]  The  properties  of  the  polymeric  materials  selected  shall  be  characterized  in  their  expected 
configurations  and  operating  environments. 

[4. 3. 3. 3-2]  Test  methods  employing  samples  representative  of  the  manufacturing  processes  involved  in 
a  specific  pressurized  system  hardware  fabrication  shall  be  employed  for  determining  material 
properties,  as  required. 

[4. 3. 3. 3-3]  The  test  specimens  and  procedures  utilized  shall  follow  standardized  test  methods  (such  as 
those  published  by  ASTM)  whenever  available  in  order  to  provide  valid  test  data  for  the  intended 
application. 

[4. 3. 3. 3-4]  A  polymeric  material’s  strength  allowable  shall  be  determined  from  testing  of  coupon, 
subscale  or  full-scale  composite  parts. 

[4. 3. 3. 3-5]  When  subscale  and  coupon  data  are  used  in  the  database,  correlation  between 
coupon/subscale  data  and  full-scale  data  shall  be  established. 

[4. 3. 3. 3-6]  Degradation  of  polymer  material  properties  in  the  presence  of  pressure  system  fluids  shall 
be  determined  in  the  material  characterization  and  considered  in  the  system  analyses  of  Section  4.2. 

[4. 3. 3. 3-7]  Particular  consideration  shall  be  given  to  potential  for  volumetric  growth  (swell)  and 
softening  of  materials  and  their  effect  on  the  system. 

4.4  Fabrication  and  Process  Control  Requirements 

[4.4-1]  Proven  processes  and  procedures  for  fabrication  and  repair  shall  be  used  to  preclude  damage  or 
material  degradation  during  material  processing,  manufacturing  operations,  and  refurbishment. 

[4.4-2]  In  particular,  special  attention  shall  be  given  to  ascertain  that  the  melting,  welding,  bonding, 
forming  joining,  machining,  drilling,  grinding,  repair,  etc.,  processes  as  applied  to  joining  system 
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components  and  hardware  and  attaching  hardware  are  within  the  state-of-the-art  and  have  been  used 
on  similar  hardware. 

[4.4-3]  The  mechanical  and  physical  properties  of  the  parent  materials,  weld-joints  and  heat-affected 
zones  shall  be  within  established  design  limits  after  exposure  to  the  intended  fabrication  processes. 

[4.4-4]  The  machining,  forming,  joining,  welding,  dimensional  stability  during  thermal  treatments, 
and  through-thickness  hardening  characteristics  of  the  material  shall  be  compatible  with  the 
fabrication  processes  to  be  encountered. 

[4.4-5]  Special  precautions  shall  be  exercised  throughout  the  manufacturing  operations  to  guard 
against  processing  damage  or  other  structural  degradation. 

[4.4-6]  Bonding,  clamping,  and  joining  at  the  interfaces  and  mountings  of  the  flight  pressure  systems 
shall  all  be  controlled  to  ensure  that  all  requirements  are  met. 

4.5  Contamination  Control  and  Cleanliness  Requirements 

Contamination  includes  solid,  liquid,  and  gaseous  material  unintentionally  introduced  into  the  system. 

4.5.1  Design  for  Contamination  Control 

[4.5. 1-1]  An  analysis  shall  be  conducted  to  determine  the  sensitivity  of  the  system  and  all  its 
components  to  contamination  levels  to  include  both  particulate  and  non-volatile  residue  (NVR). 

[4.5. 1-2]  Cleanliness  requirements  for  the  system  and  each  component  shall  be  based  on  the 
contamination  analysis  and  applied  during  assembly,  integration,  test,  and  final  operations. 

[4.5. 1-3]  Filters  shall  be  placed  in  the  system  to  protect  sensitive  components  including  pressure 
regulators,  valves,  orifices,  injectors,  and  sealing  surfaces. 

4.5.2  Filter  Design  Requirements 

[4. 5.2-1]  The  filter  rating  shall  be  based  on  the  components’  sensitivity. 

[4. 5.2-2]  Filter  capacity  shall  be  determined  based  on  the  following  aspects: 

a)  The  cleanliness  specifications  of  pressure  vessels,  components,  and  lines,  and; 

b)  the  filtration  level  of  fluids  used  in  the  system,  and; 

c)  an  allocation  for  contamination  introduced  during  manufacturing  assembly. 

4.5.3  Cleanliness  Testing 

[4. 5. 3-1]  Cleanliness  verification  tests  shall  use  flight  or  flight-representative  fluids.  Gas  is  not  an 
appropriate  medium  for  verifying  particle  count  in  a  liquid  system. 

[4. 5. 3-2]  The  minimum  flow  rate  of  fluids  during  unit  cleanliness  verification  tests  shall  match  the 
maximum  flow  rate  used  across  component  and  system-level  testing  and  in  flight  operations.  Higher 
level  assembly  cleanliness  verification  should  use  these  flow  rate  conditions  to  the  maximum  extent 
practicable. 
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[4. 5. 3-3]  Cleanliness  verification  shall  include  checks  for  particulate  and  NVR. 

4.5.4  Foreign  Object  Debris  Prevention 

[4. 5. 4-1]  Clean  room  practices  and  training  shall  be  established  and  followed  for  all  areas  where 
manufacturing,  integration,  and  test  occur. 

[4. 5. 4-2]  After  cleanliness  verification,  unsealed  components  or  subassemblies  shall  be  handled, 
transported,  and  stored  with  positive  contamination  controls  such  as  end-caps  and/or  double  bagging. 

[4. 5.4-3]  All  tools  and  tooling  aids  used  in  the  assembly  process  shall  be  inventoried  with  all 
tools/aids/hardware  independently  accounted  for  prior  to  the  next  level  of  assembly  or  integration. 

4.6  Quality  Assurance  Program  Requirements 

[4.6-1]  The  quality  assurance  program,  governed  by  Reference  14,  Reference  15,  or  their  equivalent, 
shall  include  those  attributes  necessary  to  ensure  that  the  completed  flight  pressure  systems  meets  its 
specified  requirements.  These  attributes  include  (a)  verification  that  materials,  parts,  subassemblies, 
assemblies,  and  all  completed  and  refurbished  hardware  conform  to  applicable  drawings  and  process 
specifications;  (b)  verification  means  to  ensure  that  no  damage  or  degradation  has  occurred  during 
material  processing,  fabrication,  inspection,  acceptance  testing,  shipping,  storage,  operational  use  and 
refurbishment;  and  (c)  process  controls  that  ensure  that  defects  that  could  cause  failure  are  detected, 
evaluated,  and  corrected. 

4.6.1  Inspection  Requirements 

[4. 6. 1-1]  An  inspection  plan,  which  may  consist  of  a  set  of  plans,  shall  be  established  prior  to  start  of 
system  assembly  and  installation. 

[4.6. 1-2]  The  plan  shall  specify  appropriate  inspection  points  and  inspection  techniques  for  use 
throughout  the  program,  beginning  with  material  procurement  and  continuing  through  fabrication, 
assembly,  acceptance  test,  operation,  and  refurbishment,  as  appropriate. 

[4.6. 1-3]  In  establishing  inspection  points  and  inspection  techniques,  consideration  shall  be  given  to 
the  material  characteristics,  fabrication  processes,  design  concepts,  and  structural  configuration. 

[4.6. 1-4]  Acceptance  and  rejection  criteria  shall  be  established  as  part  of  the  plan  for  each  phase  of 
inspection  and  for  each  type  of  inspection. 

Inspection  techniques  and  data  requirements  are  contained  within  References  7  and  8  for  all  pressure 
hardware.  The  sum  of  these  satisfies  system  requirements. 

4.7  Test  Requirements 

References  7  and  8  control  the  internal  and  external  qualification  pressure  testing  conducted  on  all 
pressure  vessels,  pressurized  structures,  and  pressure  components  to  demonstrate  no  failure  at  the 
design  burst  pressure.  Other  environmental  qualification  tests  are  controlled  by  Reference  10  or 
similar.  Qualification  testing  is  not  required  for  lines  and  fittings  that  are  fabricated  using  common 
aerospace  materials  and  manufacturing  processes. 
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[4.7-1]  All  flight  pressurized  systems  shall  pass  acceptance  testing  to  include  a  proof  pressure  test,  a 
leak  test  at  MEOP,  and  functional  testing  in  that  order  as  well  as  a  bonding  and  grounding  test  prior  to 
first  use.  Note  that  functional  testing  may  precede  proof  testing  within  a  particular  system  test  series 
as  long  as  functional  testing  is  conducted  at  some  time  after  the  proof  test. 

[4.7-2]  Functional  tests,  leak  tests,  and  bonding  and  grounding  tests  shall  be  conducted  after  arrival  at 
the  launch  processing  facility.  Systems  that  are  filled  and  pressurized  to  flight  levels  prior  to  arrival  at 
the  launch  facility  are  not  required  to  repeat  leak,  functional,  bonding  and/or  grounding  tests. 

4.7.1  Proof-Pressure  Test  Requirements 

[4.7. 1-1]  For  systems  with  zones  operating  at  different  pressures,  each  zone  shall  be  tested  to  its  proof 
pressure  level.  The  proof  pressure  level  will  be  limited  by  the  component  with  the  lowest  proof  factor 
within  that  zone. 

[4.7. 1-2]  Proof  pressure  testing  shall  demonstrate  that  the  flight  pressure  system  will  sustain  proof 
pressure  without  distortion,  damage,  leakage,  or  loss  of  functionality. 

[4.7. 1-3]  Zones  that  include  relief  valves  and/or  burst  disks  shall  be  proof  tested  without  the  relief 
valves  and/or  burst  disks.  The  interface  connections  to  the  relief  valves  and/or  burst  disks  will  not  be 
proof  tested  but  should  undergo  NDI  capable  of  detecting  detrimental  flaws. 

The  minimum  proof  factor  and  the  corresponding  design  burst  factor  for  tests  of  typical  pressure 
vessels,  pressurized  structures  and  pressure  components  (including  lines  and  fittings,  fluid  return 
sections,  fluid  return  hoses)  are  provided  in  References  7  and  8. 

4.7.2  System  Leak  Test  Requirements 

The  method  used  to  detect  and/or  measure  leakage  is  purposely  left  unspecified.  The  accuracy  of  the 
method  must  be  sufficient  to  verify  mission  requirements.  The  highest  accuracy  test  practicable 
should  be  utilized.  For  systems  to  be  filled  with  a  liquid  or  a  hazardous  fluid,  a  suitable  leak  check  gas 
may  be  used. 

[4. 7.2-1]  For  systems  with  zones  operating  at  different  pressures,  each  zone  shall  be  at  its  MEOP  for 
leak  tests. 

[4. 7.2-2]  The  leak  test  shall  either: 

a)  use  the  same  fluid  in  the  leak  test  as  the  system  operating  fluid  or 

b)  use  conservative  leakage  flow  correlations  between  the  leak  test  fluid  and  the  system 
operating  fluid  to  restrict  the  allowed  leak  rate. 

[4. 7.2-3]  All  mechanical  connections,  gasket  joints,  seals,  weld  seams,  and  other  items  susceptible  to 
leakage  shall  be  tested. 

[4. 7.2-4]  Valve  seals,  including  redundant  elements  relied  upon  for  fault  tolerance,  that  are  susceptible 
to  temperature-related  leakage  shall  be  tested  at  the  cold  and  hot  temperature  extremes  during 
component-level  qualification  and  acceptance  tests. 

[4. 7.2-5]  Internal  and  external  leak  rates  through  valves  (including  fill  and  drain  valves,  thruster 
valves,  pressure  relief  valves,  check  valves,  and  regulators)  shall  be  measured  and  verified  within 
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specification  at  the  pressurized  system  level  of  assembly.  Verification  at  temperature  extremes  is 
preferred  for  those  seals  that  are  susceptible  to  temperature-related  leakage.  Verification  at  higher 
levels  of  vehicle  build  are  preferred  if  practicable. 

[4. 7.2-6]  For  pressure  assisted  seals,  the  leakage  rate  shall  be  verified  at  the  minimum  predicted 
operating  pressure  at  the  pressurized  system  level  of  assembly.  Verification  at  higher  levels  of  vehicle 
build  are  preferred  if  practicable. 

4.7.3  System  Functional  Test  Requirements 

[4. 7. 3-1]  System  functional  tests,  such  as  those  conducted  as  part  of  Specification  Performance  in 
Reference  10,  shall  include  flow  checks  to  verify  component  interactions  and  the  absence  of  major 
flow  obstructions. 

[4. 7. 3-2]  The  open/close  response  of  all  valves  shall  be  verified  as  part  of  system  functional  tests. 

[4. 7. 3-3]  For  critical  flow  control  devices  such  as  regulators,  specification  performance  shall  be 
verified  as  part  of  system  functional  tests. 

[4. 7. 3-4]  As  part  of  system  functional  tests,  internally  redundant  elements  of  flow  control  devices 
(including  fill  and  drain  valves)  shall  be  independently  verified  for  specification  performance  when 
that  redundancy  is  required  by  the  fault  tolerance  design  of  the  system. 

[4. 7. 3-5]  For  actively  controlled  valves,  vehicle  level  tests  shall  verify  end-to-end  response  to 
commands. 

4.8  Operation  and  Maintenance  Requirements 
4.8.1  Operating  Procedure 

[4.8. 1-1]  Operating  procedures  shall  be  established  for  the  pressurized  system. 

[4.8. 1-2]  The  procedures  shall  be  compatible  with  the  safety  requirements  and  personnel  control 
requirements  at  the  facility  where  the  operations  are  conducted. 

[4.8. 1-3]  Step-by-step  directions  shall  be  written  with  sufficient  detail  to  allow  a  qualified  technician 
or  mechanic  to  accomplish  the  operations. 

[4. 8. 1-4]  Schematics  that  identify  the  location  and  pressure  limits  of  all  components  and  their 
interconnections  into  a  system  shall  be  included  in  the  procedure  or  be  made  available  at  the  time  it  is 
run. 

[4.8. 1-5]  Prior  to  initiating  or  performing  a  procedure  involving  hazardous  operations  with  flight- 
pressure  systems,  practice  runs  shall  be  conducted  on  non-pressurized  systems  until  the  operating 
procedures  are  well  rehearsed. 

[4. 8. 1-6]  Initial  tests  shall  then  be  conducted  at  pressure  levels  not  to  exceed  50  percent  of  the  normal 
operating  pressures  until  operating  characteristics  can  be  established  and  stabilized. 

[4. 8. 1-7]  Only  qualified  and  trained  personnel  shall  be  assigned  to  work  on  or  with  high  pressure 
systems. 
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[4.8. 1-8]  Warning  signs  identifying  the  hazards  shall  be  posted  at  the  operations  facility  prior  to 
pressurization. 

4.8.2  Inspection  and  Maintenance 

[4. 8.2-1]  The  results  of  the  stress  analysis  and  the  fatigue-life  analysis  shall  be  used  in  conjunction 
with  the  appropriate  results  from  the  structural  development  and  qualification  tests  to  develop  a 
quantitative  approach  to  inspection  and  repair. 

[4. 8.2-2]  The  allowable  damage  limits  for  each  component  of  the  flight  pressure  system  shall  be  used 
to  establish  the  required  inspection  interval  and  repair  schedule  to  maintain  the  hardware  to  the 
requirements  of  this  document. 

[4. 8.2-3]  Procedures  shall  be  established  for  recording,  tracking,  and  analyzing  operational  data  as  it  is 
accumulated  to  identify  critical  areas  requiring  corrective  actions. 

[4. 8.2-4]  Analyses  shall  include  prediction  of  remaining  life  and  reassessment  of  required  inspection 
intervals. 

4.8.3  Repair  and  Refurbishment 

[4. 8. 3-1]  When  tests/inspections  reveal  defects  exceeding  permissible  levels,  the  discrepant  hardware 
shall  be  repaired,  refurbished,  or  replaced,  as  appropriate. 

[4. 8. 3-2]  All  repaired  or  refurbished  flight  pressure  systems  shall  be  recertified  after  each  repair  and 
refurbishment  to  verify  their  structural  integrity  and  to  establish  their  suitability  for  continued  service. 

4.8.4  Storage 

[4. 8.4-1]  A  flight  pressure  system  put  into  storage  shall  be  protected  against  exposure  to  adverse 
environments  that  could  cause  corrosion  or  other  forms  of  material  degradation. 

[4. 8.4-2]  A  flight  pressure  system  shall  be  protected  against  mechanical  degradation  resulting  from 
scratches,  dents,  or  accidental  dropping  of  the  hardware. 

[4. 8.4-3]  Induced  stresses  due  to  storage  fixture  constraints  shall  be  minimized  by  suitable  storage 
fixture  design. 

[4. 8.4-4]  In  the  event  storage  requirements  are  violated,  recertification  shall  be  required  prior  to  return 
to  use. 

4.8.5  Documentation 

[4. 8. 5-1]  Inspection,  maintenance,  and  operation  records  shall  be  kept  and  maintained  throughout  the 
life  of  the  flight  pressure  system. 

[4. 8. 5-2]  As  a  minimum,  the  records  shall  contain  the  following  information: 

a)  Temperature,  pressurization  history,  and  pressurizing  fluid  for  both  tests  and  operations. 
Temperature  and  pressures  may  be  expressed  as  an  allowed  range  in  which  the  system  was 
maintained. 
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b)  Numbers  of  pressurizations  experienced  as  well  as  number  allowed  in  damage-tolerance 
(safe-life)  analysis. 

c)  Results  of  any  inspection  conducted,  including:  inspector,  inspection  dates,  inspection 
techniques  employed,  location  and  character  of  defects,  defect  origin  and  cause.  This 
includes  inspections  made  during  fabrication. 

d)  Storage  condition. 

e)  Maintenance  and  corrective  actions  performed  from  manufacturing  to  operational  use, 
including  refurbishment. 

f)  Sketches  and  photographs  to  show  areas  of  structural  damage  and  extent  of  repairs. 

g)  Acceptance  and  recertification  test  performed,  including  test  conditions  and  results. 

h)  Analyses  supporting  the  repair  or  modification  that  may  influence  future  use  capability. 

4.8.6  Reactivation 

[4. 8. 6-1]  A  flight  pressure  system  reactivated  for  use  after  a  period  in  either  an  unknown,  unprotected, 
or  unregulated  ground  storage  environment  shall  be  recertified  to  ascertain  its  structural  integrity, 
functionality,  and  suitability  for  continued  service  before  first  use. 

4.8.7  Recertification 

The  following  requirements  pertain  to  recertification  of  a  flight  pressure  system  prior  to  return  to 
service. 

[4. 8. 7-1]  The  documentation  of  affected  components  or  portions  of  the  flight  pressure  system  shall  be 
reviewed  to  establish  the  last  known  condition. 

[4. 8. 7-2]  The  pressure  system  shall  be  inspected  and  subjected  to  appropriate  ND1. 

[4. 8. 7-3]  The  pressure  system  shall  pass  all  the  acceptance  test  requirements  for  a  new  system  in 
accordance  with  Section  4.7. 

4. 8. 7.1  Test  after  Limited  Modification  and  Repair 

[4.7.7. 1-1]  If  any  system  element  such  as  valves,  regulators,  gauges,  or  tubing  has  been  disconnected 
or  reconnected  for  any  reason,  the  affected  system  or  subsystem  shall  be  leak  tested. 

[4.7.7. 1-2]  For  more  extensive  modification  or  repair  that  may  affect  its  ability  to  meet  the 
requirements  of  this  document  or  its  required  functions,  the  flight  pressurized  system  shall  meet  the 
full  recertification  requirements. 
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5.  Specific  System  Requirements 


This  section  presents  specific  design  requirements  that  are,  effectively,  corrective  actions  to  past 
issues. 

5.1  Design  Features 

Design  components  so  that,  during  the  assembly  of  parts,  sufficient  clearance  exists  to  permit 
assembly  of  the  components  without  damage  to  the  O-rings  or  backup  rings  where  they  pass  threaded 
parts  or  shaip  comers. 

5.1.1  Routing 

[5. 1.1-1]  Where  straight  runs  are  used  between  two  rigid  connection  points,  provision  shall  be  made 
for  expansion  joints,  motion  of  the  units,  or  similar  compensation  to  ensure  that  no  excessive  strains 
are  applied  to  the  tubing  and  fittings.  Line  bends  may  be  used  to  ease  stresses  induced  in  tubing  by 
alignment  tolerance  and  vibration. 

[5. 1.1-2]  Flexhoses,  meaning  any  flexible  connector  type,  shall  be  used  between  any  two  connections 
where  relative  motion  can  be  expected  to  fatigue  metal  tubes  or  pipes. 

[5. 1.1-3]  Flexhose  installation  shall  be  designed  to  avoid  abrasive  contact  with  adjacent  structure  or 
moving  parts. 

[5. 1.1 -4]  Rigid  supports  shall  not  be  used  on  flexhoses. 

5.1.2  Grounding 

[5. 1.2-1]  System  components  and  lines  shall  be  electrically  grounded  to  metallic  structures. 

5.1.3  Ground  Handling 

[5. 1.3-1]  Fixtures  for  safe  handling  and  hoisting  with  coordinated  attachment  points  in  the  system 
structure  shall  be  provided. 

[5. 1.3-2]  Flandling  and  hoisting  loads  shall  be  in  accordance  with  Reference  5. 

5.1.4  Test  Points 

[5. 1.4-1]  Test  points  shall  be  provided  such  that  disassembly  for  test  is  not  required. 

[5. 1.4-2]  The  test  points  shall  be  easily  accessible  for  attachment  of  ground  test  equipment. 

5.1.5  Common-Plug  Test  Connectors 

[5. 1.5-1]  Common-plug  test  connectors  for  pressure  and  return  sections  shall  be  designed  to  require 
positive  removal  of  the  pressure  connection  prior  to  unsealing  the  return  connections. 
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5.1.6  Individual  Pressure  Test  Connectors 


[5. 1.6-1]  Individual  pressure  test  connectors  shall  be  designed  to  positively  prevent  inadvertent  cross- 
connections. 

5.1.7  Threaded  Parts 

[5. 1.7-1]  All  threaded  parts  in  components  shall  be  securely  locked  to  resist  uncoupling  forces  by 
acceptable  safe  design  methods.  Safety  wiring  and  self-locking  nuts  are  examples  of  acceptable  safe 
design. 

[5. 1.7-2]  Torque  for  threaded  parts  in  components  shall  be  specified. 

5.1.8  Internally  Threaded  Bosses 

[5. 1.8-1]  The  design  of  internally  threaded  bosses  shall  preclude  the  possibility  of  damage  to  the 
component  or  the  boss  threads  because  of  screwing  universal  fittings  to  excessive  depths  in  the 
bosses. 

5.1.9  Retainer  or  Snap  Rings 

[5. 1.9-1]  Retainer  or  snap  rings  shall  not  be  used  in  a  pressurized  system  where  failure  of  the  ring 
would  allow  connection  failures  or  blowouts  caused  by  internal  pressure. 

5.2  Component  Selection 

In  all  cases,  flareless  tube  fittings  must  be  properly  preset  prior  to  pressure  applications. 

5.2.1  Connections 

[5.2. 1-1]  System  connections  for  incompatible  propellants  shall  be  keyed,  sized,  or  located  so  that  it  is 
physically  impossible  to  interconnect  them. 

[5.2. 1-2]  Pressure  components  shall  be  selected  to  ensure  that  misconnections  or  reverse  installations 
within  the  subsystem  are  not  possible. 

[5.2. 1-3]  Color  codes,  labels,  and/or  directional  arrows  shall  be  used  to  identify  hazards  and  direction 
of  flow. 

5.2.2  Actuator  Pressure  Rating 

[5.2.2-1]  Components  shall  be  specified  that  are  capable  of  actuation  under  pressure  equal  to  the 
MEOP  in  the  circuit  in  which  they  are  installed. 

5.3  Design  Pressures 

[5.3-1]  Actuation  of  pneumatic  systems  shall  not  be  adversely  affected  by  any  back-pressure  resulting 
from  concurrent  operations  of  other  parts  of  the  system  under  service  conditions. 
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5.4  Design  Loads 


Flexhose  installations  should  be  designed  such  that  no  stress  or  strain  of  any  nature  in  the  hard  lines 
or  components  can  be  produced.  Any  such  stress  or  strain  as  well  as  the  stress  induced  because  of 
dimensional  changes  caused  by  pressure  or  temperature  variations,  and  torque  forces  induced  in  the 
flexhoses,  is  to  be  included  in  the  design  requirements  analyses  of  Section  4.2. 

5.4.1  Acceleration  and  Shock  Loads 

[5.4. 1-1]  All  lines  and  components  shall  be  installed  to  withstand  all  expected  acceleration  and  shock 
loads.  Shock-isolation  mounts  may  be  used,  if  necessary,  to  eliminate  destructive  vibration  and 
interference  collisions. 

5.4.2  Torque  Loads 

[5. 4.2-1]  The  mounting  of  components,  including  valves,  shall  be  on  structures  having  sufficient 
strength  to  withstand  torque  and  dynamic  loads.  Only  lightweight  components  that  do  not  require 
adjustment  after  installation  may  be  supported  by  the  tubing,  provided  that  a  tube  clamp  is  installed 
on  each  tube  near  the  component. 

5.4.3  Vibration  Loads 

[5.4. 3-1]  Tubing  shall  be  supported  by  clamps  of  a  suitable  design  and  spacing  to  restrain  destructive 
vibration  loads. 

5.5  Electrical 

5.5.1  Hazardous  Atmospheres 

[5.5. 1-1]  Electric  components  for  use  in  potentially  ignitable  atmospheres  shall  be  verified  to  be 
incapable  of  causing  an  explosion  in  the  intended  application. 

5.5.2  Solenoid  Dielectric  Withstanding  Voltage 

[5. 5.2-1]  All  solenoids  shall  safely  withstand  a  test  voltage  of  not  less  than  1500  V  rms  at  60  cps  for  1 
minute  between  terminals  and  case.  See  Reference  1  Test  Method  301  for  additional  clarification  of 
this  dielectric  withstanding  voltage  test. 

[5. 5.2-2]  The  dielectric  withstanding  voltage  test  shall  occur  after  a  maximum  temperature  exposure, 
such  as  thermal  bake-out  of  the  coil  and  potting  compound,  to  verify  no  voids  or  cracked  insulation 
during  manufacture. 

5.6  Pressure  Relief 

Pressure  relief  devices  are  an  acceptable  means  of  providing  fault  tolerance  against  over-pressure 
conditions. 

5.6.1  Flow  Capacity 

[5.6. 1-1]  All  pressure  relief  devices  shall  provide  relief  at  full-flow  capacity  at  conditions  up  to  110% 
of  the  MEOP  of  the  system. 
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5.6.2  Sizing 

[5. 6.2-1]  The  size  of  pressure  relief  devices  shall  be  specified  to  withstand  maximum  pressure  and 
flow  capacities  of  the  pressure  source,  to  prevent  pressure  exceeding  1 1 0%  of  the  MEOP  of  the 
system. 

5.6.3  Negative  Pressure  Protection 

[5. 6. 3-1]  Thin-walled  vessels  that  can  collapse  by  a  negative  internal  pressure  during  hydrostatic 
testing  or  storage  and  transportation  shall  have  negative  pressure  relief  and/or  prevention  devices. 

5.6.4  Pump  Pressure  Relief 

[5. 6.4-1]  Hydraulic  systems  employing  power-operated  pumps  shall  include  a  pressure-regulating 
device  and  an  independent  safety-relief  valve. 

5.6.5  Thermal  Pressure  Relief 

[5. 6. 5-1]  Thermal-expansion  relief  valves  shall  be  installed  as  necessary  to  prevent  system  damage 
from  thermal  expansion  of  hydraulic  fluid,  as  in  the  event  of  gross  overheating.  Internal  valve  leakage 
is  not  considered  an  acceptable  method  of  providing  thermal  relief. 

5.6.6  Pressure  Relief  Vents 

[5. 6. 6-1]  The  vents  of  pressure  relief  devices  shall  outlet  only  to  areas  of  relative  safety  from  fire 
hazard. 

5.7  Hydraulic  System  Components 

5.7.1  Variable  Response 

[5.7. 1-1]  Shutoff  valves  shall  not  be  used  in  hydraulic  systems  where  the  event  of  force  balance  on 
both  inlet  ports  may  occur,  thus  causing  the  shutoff  valve  to  restrict  flow  from  the  outlet  port. 

5.7.2  Fire  Resistant  Fluids 

[5. 7.2-1]  Fire  resistant  or  flame  proof  hydraulic  fluid  shall  be  used  where  the  system  design  can 
expose  hydraulic  fluid  to  potential  ignition  sources  or  where  the  system  is  adjacent  to  a  potential  fire 
zone  and  the  possibility  of  flame  propagation  exists.  This  requirement  does  not  pertain  to  propellants, 
but  their  usage  in  hydraulic  actuation  of  other  mechanisms  must  consider  protection  against 
inadvertent  ignition. 

5.7.3  Accumulators 

[5. 7. 3-1]  Hydraulic  systems  incoiporating  accumulators  shall  be  interlocked  to  either  vent  or  isolate 
accumulator  fluid  pressure  when  power  is  shut  off. 

5.7.4  Lock  Valves 

[5. 7.4-1]  When  two  or  more  hydraulic  actuators  are  mechanically  tied  together,  only  one  lock  valve 
shall  be  used  to  hydraulically  lock  all  the  actuators. 
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[5. 7.4-2]  Hydraulic  lock  valves  shall  not  be  used  for  lockup  periods  likely  to  involve  extreme 
temperature  changes,  unless  fluid  expansion  and  contraction  effects  are  accounted  for. 

5.7.5  Cavitation 

5.7. 5.1  Inlet  Pressure 

[5. 7. 5. 1-1]  The  inlet  pressure  of  hydraulic  pumps  shall  be  specified  to  prevent  cavitation  effects  in  the 
pump  passage  or  outlets. 

5. 7. 5.2  Fluid  Column 

[5. 7. 5.2-1]  Hydraulic  systems  shall  have  positive  protections  against  breaking  the  fluid  column  in  the 
suction  line  during  standby. 

5.8  Pneumatic  System  Configuration 

[5.8-1]  The  configuration  of  pneumatic  components  shall  permit  bleeding  of  entrapped  moisture, 
lubricant,  particulate  material,  or  other  foreign  material  hazardous  to  this  system. 
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6.  System  Safety  Requirements 


The  following  requirements  are  specific  to  system  safety  which  is  governed  by  Reference  2.  The 
system  safety  requirements  are  based  on  an  approach  of  acceptable  risk  which  is  defined  as  risk  that 
the  appropriate  acceptance  authority  is  willing  to  accept.  These  requirements  are  similar  to  those 
listed  in  Reference  6,  but  distinct  in  regard  to  the  focus  on  the  vehicle  and  mission  system  safety 
aspects  as  well  as  the  governing  authority. 

Acceptance  of  risk  within  the  following  requirements  does  not  take  precedence  over  the  requirements 
listed  in  Sections  4  and  5.  Any  apparent  conflicts  that  arise  must  be  adjudicated  by  tailoring  of  or 
waivers  to  the  prior  requirements  along  with  completion  of  the  Reference  2  assessment  process. 

6.1  System  Hazard  Analysis 

[6.1-1]  A  system  hazard  analysis  shall  be  performed  on  all  pressurized  system  hardware,  to  identify 
hazards  to  the  system,  personnel  and  facilities. 

[6.1-2]  All  storage,  handling,  transportation,  prelaunch  processing,  launch,  and  post-launch  operations 
and  conditions  shall  be  included  in  the  analysis. 

[6.1-3]  A  detailed  system  physical  and  functional  analysis  of  the  pressurized  system  shall  be 
performed  to  determine  if  the  components  within  the  pressurized  system  are  capable  of  supporting  all 
requirements  without  leading  to  a  catastrophic  or  critical  mishap  based  on  their  operation,  interaction, 
environment,  and  sequence  of  events. 

[6.1-4]  The  physical  and  functional  analysis  shall  identify  any  single  malfunction,  software  error,  or 
personnel  error  in  the  operation  of  any  component  that  may  create  conditions  leading  to  an 
unacceptable  risk  of  a  mishap. 

[6.1-5]  The  physical  and  functional  analysis  shall  also  evaluate  any  secondary  or  subsequent 
occurrence,  failure,  component  malfunction,  or  software  errors  initiated  by  one  or  more  primary 
events  that  could  result  in  a  mishap. 

[6.1-6]  Hazards  identified  by  the  analysis  that  may  lead  to  catastrophic  or  critical  hazards  shall  be 
designated  as  safety-critical. 

[6.1-7]  Safety-critical  items  shall  require  mitigation  by  one  or  more  of  the  following,  listed  in  order  of 
decreasing  effectiveness: 

a)  Design  modifications  to  eliminate  the  hazard. 

b)  Reduce  risk  through  design  alteration. 

c)  Incorporate  engineered  features  or  devices  that  reduce  the  severity  or  the  probability  of  the 
mishap  potential  caused  by  the  hazard(  s).  In  general,  engineered  features  actively  interrupt 
the  mishap  sequence  and  devices  reduce  the  risk  of  a  mishap. 

d)  Provide  warning  devices. 

e)  Incorporate  signage,  procedures,  training,  and  personal  protective  equipment. 
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6.2  Redundancy 

[6.2-1]  System  analysis  data  shall  show  that: 

a)  In  systems  where  pressure  regulator  failure  involves  a  safety-critical  hazard,  regulation  is 
redundant  and  where  passive  redundant  systems  are  used  includes  automatic  switchover. 

b)  When  the  hazardous  effects  of  safety  critical  failures  or  malfunctions  are  prevented  through 
the  use  of  redundant  components  or  systems,  all  such  redundant  components  or  systems 
have  a  high  probability  of  being  operational  prior  to  the  initiation  of  irreversible  portions  of 
safety  critical  operations  or  events. 

6.3  Low  Safety  Factor  Relief  Requirement 

[6.3-1]  In  the  event  of  launch  abort,  safety-critical  pressure  vessels  with  safety  factors  less  than  2.0  in 
the  design  shall  provide  a  means  for  the  automatic  relief,  depressurization,  and  pressure  verification 
of  the  vessels. 

6.4  Control  Devices 

6.4.1  Directional  Control  Valves 

[6.4. 1-1]  Safety-critical  pressure  systems  shall  be  designed  to  incoiporate  two  or  more  directional 
control  valves  to  preclude  the  possibility  of  inadvertently  directing  the  flow  or  pressure  from  one 
valve  into  the  flow  or  pressure  path  intended  for  another  valve,  with  any  combination  of  valve 
settings  possible  in  the  total  system. 

6.4.2  Overtravel 

[6.4.2- 1]  Control  devices  shall  be  designed  to  prevent  overtravel  or  undertravel  that  may  contribute  to 
a  hazardous  condition,  or  damage  to  the  valve. 

6.5  Component  Requirements 

6.5.1  Cycling 

[6.5. 1-1]  Cycling  capability  for  pressure  components  as  specified  in  Reference  7  that  are  safety- 
critical  per  Section  6. 1  shall  be  not  less  than  four  times  the  total  number  of  expected  cycles,  including 
system  tests,  but  not  less  than  2000  cycles  (including  the  life  factor  of  four).  This  cycling  verification 
includes  operation  over  the  required  temperature  range. 

6.5.2  Actuators 

[6. 5.2-1]  Safety  critical  actuators  shall  have  positive  mechanical  stops  at  the  extremes  of  safe  motion. 
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